At least since I've been using Facebook, this is the first time that Mark Zuckerberg has addressed the Facebook community through an open letter linked from the main user page. I find it interesting that the focus of this is privacy and the future of privacy on Facebook.

An Open Letter from Facebook Founder Mark Zuckerberg Facebook

by Mark Zuckerberg Yesterday at 6:23pm

It has been a great year for making the world more open and connected. Thanks to your help, more than 350 million people around the world are using Facebook to share their lives online.

To make this possible, we have focused on giving you the tools you need to share and control your information. Starting with the very first version of Facebook five years ago, we've built tools that help you control what you share with which individuals and groups of people. Our work to improve privacy continues today.

Facebook's current privacy model revolves around "networks" — communities for your school, your company or your region. This worked well when Facebook was mostly used by students, since it made sense that a student might want to share content with their fellow students.

Over time people also asked us to add networks for companies and regions as well. Today we even have networks for some entire countries, like India and China.

However, as Facebook has grown, some of these regional networks now have millions of members and we've concluded that this is no longer the best way for you to control your privacy. Almost 50 percent of all Facebook users are members of regional networks, so this is an important issue for us. If we can build a better system, then more than 100 million people will have even more control of their information.

The plan we've come up with is to remove regional networks completely and create a simpler model for privacy control where you can set content to be available to only your friends, friends of your friends, or everyone.

We're adding something that many of you have asked for — the ability to control who sees each individual piece of content you create or upload. In addition, we'll also be fulfilling a request made by many of you to make the privacy settings page simpler by combining some settings. If you want to read more about this, we began discussing this plan back in July.

Since this update will remove regional networks and create some new settings, in the next couple of weeks we'll ask you to review and update your privacy settings. You'll see a message that will explain the changes and take you to a page where you can update your settings. When you're finished, we'll show you a confirmation page so you can make sure you chose the right settings for you. As always, once you're done you'll still be able to change your settings whenever you want.

We've worked hard to build controls that we think will be better for you, but we also understand that everyone's needs are different. We'll suggest settings for you based on your current level of privacy, but the best way for you to find the right settings is to read through all your options and customize them for yourself. I encourage you to do this and consider who you're sharing with online.

Thanks for being a part of making Facebook what it is today, and for helping to make the world more open and connected. Mark Zuckerberg

Labels: facebook, privacy, social networking

This just in:

News Release: Facebook agrees to address Privacy Commissioner’s concerns - August 27, 2009

Privacy Commissioner of Canada satisfied that proposed changes to the social networking site’s privacy practices and policies would bring Facebook into compliance with Canadian law.

OTTAWA, August 27, 2009 — Facebook has agreed to add significant new privacy safeguards and make other changes in response to the Privacy Commissioner of Canada’s recent investigation into the popular social networking site’s privacy policies and practices.

The company’s decision to implement the Privacy Commissioner’s recommendations is a positive step towards bringing Facebook in line with the requirements of Canada’s privacy law.

“These changes mean that the privacy of 200 million Facebook users in Canada and around the world will be far better protected,” says Privacy Commissioner Jennifer Stoddart.

“This is extremely important. People will be able to enjoy the benefits of social networking without giving up control of their personal information. We’re very pleased Facebook has been responsive to our recommendations.”

Last month, the Privacy Commissioner issued a report on an in-depth investigation triggered by a complaint from the Canadian Internet Policy and Public Interest Clinic.

While Facebook took some steps to resolve privacy concerns, the Commissioner remained dissatisfied by Facebook’s response at the end of the investigation. She was particularly concerned about the risks posed by the over-sharing of personal information with third-party developers of Facebook applications such as games and quizzes.

Facebook was given 30 days to respond to the Commissioner’s report and explain how it would address the outstanding concerns. Following a review of Facebook’s formal response and discussions with company officials, the Commissioner is now satisfied Facebook is on the right path to addressing the privacy gaps on its site.

“Facebook is promising to make significant technological changes to address the issue we felt was the biggest risk for users – the relatively free flow of personal information to more than one million application developers around the world,” says Assistant Commissioner Elizabeth Denham, who led the investigation on behalf of the Office.

“Application developers have had virtually unrestricted access to Facebook users’ personal information. The changes Facebook plans to introduce will allow users to control the types of personal information that applications can access.”

An over-arching issue highlighted during the investigation was that the way in which Facebook provides privacy information to users is often confusing or incomplete.

Facebook agreed to changes to help users to better understand how their personal information will be used and, ultimately, to make more informed decisions about how widely to share that information. The Commissioner has reviewed these improvements and will be following up with Facebook as the changes are implemented.

The following is an overview of key issues raised during the investigation and Facebook’s response:

1. Third-party Application Developers

Issue: The sharing of personal information with third-party developers creating Facebook applications such as games and quizzes raises serious privacy risks. With more than one million developers around the globe, the Commissioner is concerned about a lack of adequate safeguards to effectively restrict those developers from accessing users’ personal information, along with information about their online “friends.”

Response: Facebook has agreed to retrofit its application platform in a way that will prevent any application from accessing information until it obtains express consent for each category of personal information it wishes to access. Under this new permissions model, users adding an application will be advised that the application wants access to specific categories of information. The user will be able to control which categories of information an application is permitted to access. There will also be a link to a statement by the developer to explain how it will use the data.

This change will require significant technological changes. Developers using the platform will also need to adapt their applications and Facebook expects the entire process to take one year to implement.

2. Deactivation of Accounts

Issue: Facebook provides confusing information about the distinction between account deactivation – whereby personal information is held in digital storage – and deletion – whereby personal information is actually erased from Facebook servers. As well, Facebook should implement a retention policy under which the personal information of users who have deactivated their accounts will be deleted from the site’s servers after a reasonable length of time.

Response: Facebook has agreed to make it clear to users that they have the option of either deactivating their account or deleting their account. This distinction will be explained in Facebook’s privacy policy and users will receive a notice about the delete option during the deactivation process.

While we asked for a retention policy, we looked at the issue again and considered what Facebook was proposing. We determined the company’s approach – providing clarity about the options, offering a clear choice, and alleviating the confusion – is acceptable because it will allow users to make informed decisions about how their personal information is to be handled.

3. Personal Information of Non-users

Issue: Facebook should better protect the privacy of non-users who are invited to join the site.

Response: Facebook agreed to include more information in its terms of use statement. Facebook confirmed that it does not use email addresses to track the success of its invitation feature, nor does it maintain a separate email address list for this purpose.

4. Accounts of Deceased Users

Issue: People should have a better way to provide meaningful consent to have their account “memorialized” after their death. As such, Facebook should be clear in its privacy policy that it will keep a user’s profile online after death so that friends can post comments and pay tribute.

Response: Facebook agreed to change the wording in its privacy policy to explain what will happen in the event of a user’s death.

Facebook has committed to a timetable for implementing all of the changes, some of which, such as the third-party application changes, are technologically complex. The company has already started to make changes and we expect them to be fully complete within a year.

“It’s now up to Facebook to demonstrate to us that they are living up to their commitments,” says Assistant Commissioner Denham.

“With the conclusion of the Facebook investigation, our Office has made clear our expectations for how social networking sites need to protect personal information. Other sites should take note – and take steps to ensure they’re complying with Canadian law.”

Statements by the Commissioner and Assistant Commissioner are available on the OPC’s website.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

Remarks by Jennifer Stoddart, Privacy Commissioner of Canada

Remarks by Elizabeth Denham, Assistant Privacy Commissioner of Canada

Letter from OPC to CIPPIC outlining its resolution with Facebook

Labels: facebook, privacy, social networking

Apparently both the Privacy Commissioner of Canada and Facebook intend to hold separate press conferences tomorrow to discuss the outcome of the last month of negotiations between the two about whether Facebook is in compliance with Canadian privacy laws. See: Canada may reveal next step on Facebook privacy.

Labels: facebook, privacy, social networking

According to the Toronto Star, the Privacy Commissioner is going to accept Facebook's friend request, just on the eve of the deadline to comply with the Commissioner's prevous adverse finding:

TheStar.com Canada Facebook, privacy commissioner make friends

Susan Delacourt

Ottawa Bureau

OTTAWA – Friendship, fittingly, appears to have broken out in the dispute between Canada's privacy commissioner and the Facebook social networking site.

Today is the 30-day deadline for Facebook to respond to a strongly worded report issued last month by Canada's privacy commissioner, Jennifer Stoddart, criticizing how people's personal information was being treated by the global giant in online friendships.If Stoddart is not happy with Facebook's response, she has 15 days to decide whether to get the Federal Court of Canada involved.

But the two sides appear to be solving their problems in harmony.

Alexandra Brown, a Toronto spokesperson for Facebook, said a formal response is being sent today to the privacy commissioner's office, complete with timelines for Facebook to respond to the concerns raised in last month's report. Over the past month, the two sides have reportedly been working well together, with privacy-commission officials paying a visit to Facebook headquarters in Palo Alto, Calif., to negotiate a compromise.

"I know there's been lots of discussion and there will continue to be discussion over the next 15 days," Brown said.

Canada's privacy commission was sounding similarly upbeat about the status of the dispute.

Anne-Marie Hayden, a spokesperson for the commission said: "We continue to have very positive discussions with Facebook.... It's going very well."

Neither side was willing to talk about details of their agreement to date or even what is in the report that Facebook sent to the privacy office today. Hayden said that the privacy commission needs time to review what Facebook has filed, and more will be said closer to the next deadline, 15 days from now.

Stoddart's original report on Facebook last month identified concerns in the following areas:

* A lack of adequate safeguards to restrict outside software developers — of games, quizzes and the like — from gaining access to personal profiles of users and their online friends.

* Facebook's indefinite retention of personal information of people who have deactivated their accounts.

* A lack of clarity about how Facebook material can be used in the event of a person dying, which the privacy office calls "memorialization" concerns.

* A lack of protection of information about non-users — people who may not have their own Facebook accounts, but whose personal data may be on friends' or associates' pages.

Labels: facebook, privacy, social networking

Following the Commissioner's adverse finding against Facebook, the social networking site's deadling to respond is tomorrowf (See: Canadian Privacy Law Blog: Canadian Privacy Commissioner calls on Facebook to improve privacy practices). I don't expect a big response from Facebook, so we'll have to wait to see if the Commissioner takes them to court. See: Facebook must satisfy Canada's privacy commissioner by Monday.

Labels: facebook, privacy, social networking

The next in the series of three privacy OpEds in the National Post goes to Phillipa Lawson, formerly of CIPPIC:

Give privacy laws teeth Internet use in Canada has had enormous economic and social benefits; individuals and organizations can now broadcast their ideas, promote their businesses and build communities of interest instantly, at minimal cost, worldwide. But technology is a double-edged sword; it can be used for bad as well as good, and the impacts of its use even for non-criminal purposes are not all positive. The greatest casualty of our enthusiastic embrace of the Internet is, without doubt, individual privacy.

Fraudsters, identity thieves, stalkers and vengeance-seekers are using the Internet to solicit, track and prey on victims, often by taking advantage of the vast amount of personal information available online. While such information is a gold mine for imposters and stalkers, its collection, use and trading by non-criminals can be equally damaging for the individuals whose personal information is at issue.

Careless or malicious posting of photos, videos and personal information online can have devastating reputational impacts on individuals -- impacts that may never fully disappear because the digitized information, once released online, never disappears.

A video posted on You-Tube, for example, can turn a small-town student into an instant celebrity, but it can also provoke ridicule worldwide. False rumours can spread like wildfire. Embarrassing photographs posted online can seriously impede future employment prospects. And because the digital medium is so persistent, reputational effects may never be overcome.

Easily abused personal information is offered up to a remarkable extent by individuals themselves on social-networking sites, personal blogs and chat rooms. But many users don't appreciate the extent to which such information is publicly accessible, easily gathered and compiled by others and thus vulnerable to abuse. Only a minority of Facebook users, for example, bother to adjust their privacy settings from the defaults set by Facebook, which are to share with everyone in the Facebook-determined networks they have joined.

Personal information is also made public by friends, acquaintances and organizations who post it online often without the individual's knowledge, let alone consent. Once discovered, it can be too late to undo the damage caused, for instance, by publication of an indiscreet photo or the home address of a high-risk social worker.

Furthermore, there is a huge industry in the collection and trading of personal information, much of it covert. Marketers want to manipulate us into buying more stuff. Insurers want to minimize their risk. Employers want reliable, mature employees. Governments want to make sure that we aren't threatening national security.

Privacy law is about protecting our right to control with whom we share information about ourselves. But it should also recognize that certain uses are simply inappropriate, and that "consent" is often no more than a fiction.

Canada has a reasonably good set of data-protection laws. In general, corporations are required to get our informed consent before collecting, using or disclosing our personal data, and can do so only for purposes that a reasonable person would consider appropriate in the circumstances. Government entities can collect, use and disclose our data only for certain specified purposes.

But these laws do not place explicit limits on the collection and use of personal information posted by children, who are most vulnerable to abuse online.

Nor do our laws, outside Quebec, Alberta and B. C., place significant limits on non-commercial and nongovernmental uses of personal data without consent. While courts are starting to recognize a common-law right to privacy that would fill this gap, there is little to protect most Canadians from privacy abuses that arise outside the commercial or government context.

Moreover, existing privacy laws are only as good as their enforcement. At least one study has shown that there is widespread non-compliance with Canadian privacy laws, especially in the commercial sector.

This is not surprising given that the costs of non-compliance are minimal. The federal privacy commissioner is limited to making recommendations. Complainants in most jurisdictions must engage in expensive lawsuits in order to get binding orders for which they will likely receive no compensation.

This is not good enough. Privacy laws should apply to non-commercial as well as commercial activities. They should prohibit collection and use of kids' data, other than in exceptional cases. They should require meaningful consent, not just an easily overlooked opt-out check box. And we should be able to hold others accountable under privacy laws without undue effort and cost -- it's time to put some teeth into our privacy laws.

Philippa Lawson was director of the Canadian Internet Policy and Public Interest Clinic (CIPPIC) at the University of Ottawa from 2003 to 2008 and currently practises law in Whitehorse, Yukon.

Labels: facebook, privacy, social networking

Jacob Glick, Canadian policy counsel for Google Inc., has a good OpEd piece in today's National Post. I agree that innovators need to build privacy into their products, not only to manage their own risks but as members of society who have responsibilities for their users. I would say that responsibility is heightened for companies whose products are used by young people who may have an under-developed sense of privacy.

Privacy is in the product

This week, the National Post brings you a three-part series on the rocky place where the Internet meets the law. The question put to today's contributors: Given the proliferation of personal information on the Internet, especially on social-networking sites such as Facebook, how must Canada's laws adapt to ensure our privacy online?

When I moved to Ottawa four years ago, social-networking sites helped me keep up with my friends in Toronto and elsewhere -- in a way and on a scale that wasn't possible previously. Recently, I started micro-blogging on Twitter (mostly because I'm too lazy to blog more than 140 characters at a time) to share my thoughts on work-related matters and other miscellany. Through the Internet, we're reshaping the ways we do business, communicate and represent ourselves to the world. The good news is, we can embrace these changes without surrendering our privacy.

Privacy protection can and ought to be at the heart of innovative tools -- not only as a matter of legal compliance, but also as a principle of product design. This is what Ontario's Information and Privacy Commissioner, Dr. Ann Cavoukian, calls "Privacy by Design."

Questions about the sufficiency of Canada's privacy regime, while relevant, miss the bigger picture. Privacy is best protected by good product design. In fact, Canada has a well-functioning private-sector privacy regime. The Internet is not a Wild West: Existing rules related to legal jurisdiction and privacy apply online, as they do in the physical world. Internet companies, just like their brick-and-mortar brethren, are legally accountable for the ways they collect, use and disclose personal information.

For example, street-level photography has long been part of cartography. With a quick trip to your local municipal archive, you'll discover thousands of photos, taken over decades, of our urban landscapes. For those of us who can't read maps, seeing the world at street level is the easiest way to get around unfamiliar locales. Google Street View takes this traditional discipline and integrates it with digital mapping.

Google's approach is to build products that harness the power of the Internet while protecting privacy for the benefit of hundreds of millions of people worldwide, including tens of millions of Canadians. That's why we have built facial and license-plate blurring into Google Street View and why we make it easy for Canadians to request that we remove any image containing themselves, their kids, their cars or their homes -- even if the image is already blurred. There are privacy rules that apply to Google Street View just as they do to more traditional cartographers.

In addition to offering more accessible and useful mapping data, today's online applications provide exciting tools for collaboration and community building. They help us break through the alienation endemic to urban society and reconnect with our communities in new and fun ways. For example, here in Ottawa, online groups and web-sites give new parents a great support network and help them find local activities they can enjoy with their kids.

One of these innovative communications and collaboration tools is YouTube, a revolutionary platform that turned four this year. YouTube enables people to make their videos, professional or amateur, available worldwide. This ability can blur the line between the public and the private spheres, and Canadians get that. They also know that they are in control of what they post on YouTube -- and with whom they share it.

That's why not every video on YouTube has to be made public. Some can be shared with a smaller circle of friends. That's also what Google has done with the recent launches of Google Latitude, our mobile feature which enables users to select people to share their location with, and our Interest-based advertising system, which was built with tools that allow users to specify which categories of ads they'd like to see (or not see).

Of course, to make sensible choices people must have products that let them make such choices. Innovators should therefore develop applications in which privacy is built in from the start, so that Canadians can control the parts of themselves they reveal to the world.

Regulators ought to hold companies accountable for their privacy practices. However, privacy ultimately should be about good product design -- not just about legislation, regulation or compliance. The best products and businesses will have transparency and user choice built right in. Canadians should expect it.

-Jacob Glick is Canada policy counsel for Google.

Labels: facebook, privacy, social networking

The Privacy Commissioner of Canada has determined that Facebook needs to improve its privacy practices to comply with Canadian privacy laws.

The Report is here: Commissioner’s Findings - PIPEDA Case Summary #2009-008: Report of Findings: CIPPIC v. Facebook Inc. - July 16, 2009.

Here's the media release:

News Release: Facebook needs to improve privacy practices, investigation finds - July 16, 2009

Privacy Commissioner recommends steps to ensure social networking site better protects the privacy of users and meets the requirements of Canadian privacy legislation

OTTAWA, July 16, 2009 — In order to comply with Canadian privacy law, Facebook must take greater responsibility for the personal information in its care, the Privacy Commissioner of Canada said today in announcing the results of an investigation into the popular social networking site’s privacy policies and practices.

“It’s clear that privacy issues are top of mind for Facebook, and yet we found serious privacy gaps in the way the site operates,” says Privacy Commissioner Jennifer Stoddart.

The investigation, prompted by a complaint from the Canadian Internet Policy and Public Interest Clinic, identified several areas where Facebook needs to better address privacy issues and bring its practices in line with Canadian privacy law.

An overarching concern was that, although Facebook provides information about its privacy practices, it is often confusing or incomplete. For example, the “account settings” page describes how to deactivate accounts, but not how to delete them, which actually removes personal data from Facebook’s servers.

The Privacy Commissioner’s report recommends more transparency, to ensure that the social networking site’s nearly 12 million Canadian users have the information they need to make meaningful decisions about how widely they share personal information.

The investigation also raised significant concerns around the sharing of users’ personal information with third-party developers creating Facebook applications such as games and quizzes. (There are more than 950,000 developers in some 180 countries.) Facebook lacks adequate safeguards to effectively restrict these outside developers from accessing profile information, the investigation found.

The report recommended a number of changes, including technological measures to ensure that developers can only access the user information actually required to run a specific application, and also to prevent the disclosure of personal information of any of the user’s friends who are not themselves signing up for an application.

The investigation also found that Facebook has a policy of indefinitely keeping the personal information of people who have deactivated their accounts – a violation of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s private-sector privacy law. The law is clear that organizations must retain personal information only for as long as is necessary to meet appropriate purposes.

Recommendations to Facebook included the adoption of a retention policy whereby personal information in deactivated accounts is deleted after a reasonable length of time.

Facebook has agreed to adopt many of the recommendations stemming from the Privacy Commissioner’s investigation or, in some cases, has proposed reasonable alternatives to the measures recommended. However, there remain a number of recommendations that Facebook has not yet agreed to implement.

“We urge Facebook to implement all of our recommendations to further enhance their site, ensure they are in compliance with privacy law, and ultimately show themselves as models of privacy,” says Assistant Commissioner Elizabeth Denham, who led the investigation on behalf of the Office.

“Social networking sites can be a wonderful way to connect. They help us keep up with friends and share ideas and information with people around the globe. It is important for these sites to be in compliance with the law and to maintain users’ trust in how they collect, use and disclose our personal information.”

The Office of the Privacy Commissioner will review after 30 days the actions Facebook takes to comply with the recommendations. The Commissioner is empowered to go to Federal Court to seek to have her recommendations enforced.

“The privacy issues stemming from social networking sites are still relatively new. All of us – social networking sites, users and data protection authorities – are only beginning to develop the appropriate rules of engagement in this new world of online communication,” says Assistant Commissioner Denham. “The findings of our Facebook investigation are an important contribution to the development of these rules.”

While the investigation recommendations are aimed at Facebook, Assistant Commissioner Denham said users of social networking sites also have responsibilities.

“We asked Facebook to clearly advise users about its privacy practices, but it’s still up to the user to actually read it and use the privacy tools to control how their information is shared,” she says. As a result of the investigation, Facebook has announced a new privacy tool for its site, which is aimed at giving users more control over who gets to see each item on their Facebook page.

A detailed report on the Facebook investigation is available at www.priv.gc.ca. The website also includes information about some of the other work the Privacy Commissioner’s Office has done on social networking, including guidelines for employers and public education materials.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

Labels: facebook, privacy, social networking

Labels: facebook, privacy, social networking

A lesson that just because you're not on Facebook, your friends, acquaintances and spouses may have put your information up there. Or information that may compromise your eligibility to be the head of the British Secret Intelligence Service (aka MI6): MI6 chief blows his cover as wife's Facebook account reveals family holidays, showbiz friends and links to David Irving Mail Online.

Labels: facebook, privacy, social networking

Facebook is responding to privacy backlash concerns by introducing a new unified privacy interface and making users more aware of where their posted materials may be broadcast on the service. This stems, in part, from their plans to make users postings available system-wide like Twitter. (See: Canadian Privacy Law Blog: One privacy step forward, one back for Facebook.)

This is a Good Thing, in my view. The more control you give people to make informed decisions about their privacy, the better. Even if they're completely ignored, it's harder for people to later say they didn't know what was going on. Privacy is about giving people the ability to make informed choices about how their information is collected, used and disclosed.

A copy of a WebEx given by Facebook is available here: Facebook’s Complete Privacy Presentation.

And some additional details are on Facebook's blog: Facebook Improving Sharing Through Control, Simplicity and Connection.

Some coverage from SiliconValley.com.

Responding to privacy concerns, Facebook streamlines user controls - SiliconValley.com

By Scott Duke Harris and Elise Ackerman

Mercury News

Posted: 07/01/2009 11:57:07 AM PDT

Amid mounting concerns about Internet privacy, Facebook on Wednesday announced plans to streamline its user controls by introducing a "Unified Privacy Page."

The Palo Alto social-networking leader said it was taking action to address common complaints among its more than 200 million users worldwide about privacy. The company also announced that it is phasing out familiar regional networks such as "Silicon Valley" to minimize confusion.

Facebook credits its growth to fostering a culture that assures privacy and encourages authenticity. But in the past, Facebook has also engendered controversy by gathering data without user consent — a practice later reversed amid a user backlash.

On Wednesday, Facebook also sought to allay puzzlement and concerns over its fledgling "Everyone" posting feature, which it introduced in March. The feature, Facebook says, eventually will enable users to broadcast messages, photos and video far beyond their personal social networks and to the Internet at large. Facebook is vague about products, but acknowledged they could take the form of bulletin boards or forums on a vast array of topics, as well as a new searchable database.

The "Everyone" initiative has helped revive questions about Facebook's dedication to privacy safeguards. Jeffrey Chester, executive director of the Center for Digital Democracy, portrayed the latest changes as a public relations gimmick.

"I think Facebook realizes they have a political problem,'' he said. "They are in denial. They are in digital denial."

Full control

But Facebook Chief Privacy Officer Chris Kelly, in a conference call with reporters and analysts, insisted that Facebook's fundamental philosophy remains to give users full control over their privacy settings, and said the changes will simplify those controls.

"We've always believed privacy controls enhance this mission," Kelly said.

Facebook users can expect the changes to be tested and refined over the next three weeks. The Unified Privacy Page, the company said, should alleviate user frustration by simplifying and consolidating some 45 privacy settings scattered across six pages in the current format.

Facebook, because of its size and influence, is closely watched by Internet privacy advocates in the United States and abroad. It is the only company listed among 16 "hot policy issues" on the home page of the Washington, D.C.-based Electronic Privacy Information Center, along with such general topics as "domestic surveillance," "cloud computing," "search engine privacy" and "social-networking privacy." Marc Rotenberg, executive director of the Electronic Privacy Information Center, advised Facebook users to carefully watch the changes.

"Changing user settings is a risky strategy, particularly in the privacy world. And this is always what gets Facebook into trouble," Rotenberg said. "It will be very important that users are not opted-in to data sharing under the new settings where they had previously opted out with the original settings.

"Facebook also needs to do more to address data collection by third-party app developers," he added. "Too much personal information, made public by Facebook, ends up in secret profiles."

The Center for Digital Democracy's Chester flatly questioned Kelly's statement that Facebook allows users to control data shared with advertisers. "That's not true. The fact of the matter is they are really not transparent when it comes to how the data is used for advertising," Chester said. "We think it's a black box."

Pop-up questions

Facebook said care will be taken to guide users through the changing privacy process. There will be, for example, pop-up questions to make users doubly aware of where their posts will be sent.

Facebook has already started phasing out the regional networks users often join. About half of Facebook users opted in to such networks, the purpose of which often has caused confusion as Facebook has grown and attracted users with identical and similar names.

Local businesses and advertisers that relied on such networks for marketing will instead be able to use data such as city of residence to reach Facebook users.

Labels: facebook, privacy, social networking

One step forward and one step backward for privacy on Facebook ...

One Step Back: According to the New York Times (The Day Facebook Changed - Messages to Become Public by Default - NYTimes.com), Facebook "feeds" will become publicly available. This is seen as a step to compete with Twitter. This will surprise and upset a lot of Facebook users.

One Step Forward: Facebook will let users specify privacy settings for individual status updates, so you can let your real friends know you're hung over but your acquaintances will remain clueless (Facebook More Ways to Share in the Publisher).

Facebook shoud have learned from the Feed and Beacon debacles by making the default settings more privacy protective. Choice is good, but assuming that people want to disclose more of their personal information is not a good idea.

Labels: facebook, privacy, social networking

Applying for a job with the city of Bozeman, Montana? Check out what's on the application:

"Please list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc.," the City form states. There are then three lines where applicants can list the Web sites, their user names and log-in information and their passwords.

I've never seen anything like this, and I've seen some intrusive stuff. (And, of course, it forces the user the violate the terms of use of each of those sites.) From Montana's News Station, via Boing Boing.

Labels: facebook, privacy, social networking

I was invited to co-chair and present at the Canadian Institute's "Meeting Your Privacy Obligations" conference in Toronto. My presentation was specifically about managing privacy in the workplace, which is below if you're interested.

Here's a link if Google Docs aren't giving you due respect: Managing Privacy in Employee Relations

I have to say it was one of the best conferences of its kind that I've been to recently. The stellar speakers included Federal Privacy Commissioner Jennifer Stoddart, Alberta Information and Privacy Commissioner Frank Work and fellow bloggers Brian Bowman and Dan Michaluk. (Note: If you're reading my blog, you'll find theirs to be equally interesting and useful. So after you've read all my postings, head over there ...)

Labels: employment, facebook, media-mention, presentations, privacy, vanity, workplace

Here's something interesting ...

An advisory opinion by the Philadelphia Bar Association says it's unethical to ask a third party to friend someone on Facebook to obtain information about them:

Attorney Can’t Ask 3rd Party to ‘Friend’ Witness on Facebook, Opinion Says ABA Journal - Law News Now

Attorney Can’t Ask 3rd Party to ‘Friend’ Witness on Facebook, Opinion Says

Posted May 5, 2009, 07:38 pm CDT By Martha Neil

A lawyer who wants to see what a potential witness says to personal contacts on his or her Facebook or MySpace page has one good option, a recent ethics opinion suggests: Ask for access.

Alternative approaches, such as secretly sending a third party to "friend" a Facebook user, are unethical because they are deceptive, says the Philadelphia Bar Association in a March advisory opinion.

Not telling the potential witness of the third party's affiliation with the lawyer "omits a highly material fact, namely, that the third party who asks to be allowed access to the witness’s pages is doing so only because he or she is intent on obtaining information and sharing it with a lawyer for use in a lawsuit to impeach the testimony of the witness," the opinion explains.

"The omission would purposefully conceal that fact from the witness for the purpose of inducing the witness to allow access, when she [might] not do so if she knew the third person was associated with the inquirer and the true purpose of the access was to obtain information for the purpose of impeaching her testimony."

Facebook and MySpace profiles are different from public spaces where one can freely film and record others, the opinion says, because an invitation is required to access them, notes a Social Media Today post on the opinion.

Join the discussion about this issue over at Slaw.ca: Is it OK to use deceit to get Facebook users’ info?.

Labels: facebook, litigation, privacy, social networking

Labels: europe, facebook, privacy, surveillance, uk

Here we go again .... the government is preparing a new "lawful access" law. The media coverage seems to suggest that it covers both eavesdropping of internet based communications (with a warrant) and obtaining subscriber data (without a warrant).

globeandmail.com: New law to give police access to online exchanges

BILL CURRY

From Thursday's Globe and Mail

February 12, 2009 at 3:39 AM EST

OTTAWA — The Conservative government is preparing sweeping new eavesdropping legislation that will force Internet service providers to let police tap exchanges on their systems - but will likely reignite fear that Big Brother will be monitoring the private conversations of Canadians.

The goal of the move, which would require police to obtain court approval, is to close what has been described as digital "safe havens" for criminals, pedophiles and terrorists because current eavesdropping laws were written in a time before text messages, Facebook and voice-over-Internet phone lines.

The change is certain to please the RCMP and other police forces, who have sought it for some time. But it is expected to face resistance from industry players concerned about the cost and civil libertarians who warn the powers will effectively place Canadians under constant surveillance.

Public Safety Minister Peter Van Loan confirmed the plan yesterday during an appearance before a House of Commons committee and offered further explanation afterward.

Public Safety Minister Peter Van Loan confirmed the plan. (Sean Kilpatrick/The Canadian Press)

"We have legislation covering wiretap and surveillance that was designed for the era of the rotary phone," Mr. Van Loan said.

"If somebody's engaging in illegal activities on the Internet, whether it be exploitation of children, distributing illegal child pornography, conducting some kind of fraud, simple things like getting username and address should be fairly standard, simple practice. We need to provide police with tools to be able to get that information so that they can carry out these investigations."

Mr. Van Loan said there have been situations where the police want to act quickly to stop a crime, but can't because of the current laws.

"In some of these cases, time is of the essence," he said. "If you find a situation where a child is being exploited live online at that time - and that situation has arisen before - police services have had good co-operation with a lot of Internet service providers, but there are some that aren't so co-operative."

Although police agencies have been calling for such a law since at least the mid-1990s, this would be the first legislative effort in this direction by the Conservatives.

The reaction can be predicted, however, because Paul Martin's Liberal government faced stiff resistance when his public safety minister, Anne McLellan, introduced a "lawful-access" bill in November, 2005, shortly before that government was defeated.

The Conservative justice critic at the time, Peter MacKay, who is now in the Conservative cabinet, expressed concern with the bill, and Privacy Commissioner Jennifer Stoddart went further, saying there was no justification for such a law.

The concern of critics is that unlike a traditional wiretap that cannot commence without judicial approval, lawful-access legislation in other countries has forced Internet providers to routinely gather and store the electronic traffic of their clients. Those stored data can then be obtained by police via search warrant.

"That means we're under surveillance, in some sense, all the time," said Richard Rosenberg, president of the B.C. Freedom of Information and Privacy Association. "I think that changes the whole nature of how we view innocence in a democratic society."

RCMP Commissioner William Elliott said yesterday the lack of such legislation is causing problems for police.

"We're speaking generally about the development of technology that is difficult or impossible to wiretap," Mr. Elliott said after appearing alongside Mr. Van Loan at the House of Commons Public Safety and National Security Committee.

"In the old days, for a wiretap it was pretty simple. You sort of clicked onto the physical wires. So we have some instances where the court authorizes us and other police forces, for example, to intercept communications, but we don't have the technical ability to do that. So certainly the RCMP is supportive of changes of legislation that would allow those kind of intercepts."

Labels: facebook, law enforcement, lawful access, lawful authority, privacy, social networking, surveillance

The title says it all. If you use Facebook, you should read this: 10 Privacy Settings Every Facebook User Should Know. And act on it.

Labels: facebook, privacy, social networking

Facebook has just won a multi-multi-million dollar judgment against a Montreal residet under the American CAN-SPAM Act after the individual was accused of sending millions of unsolicited commercial e-mails to Facebook users. The company will never see most of the cash, but Facebook has said they'll go after all they can.

Hopefully, this will be a strong, visible deterrent.

See: The Associated Press: Facebook wins $873M judgment against spammer.

Labels: facebook, privacy, social networking, spam

A client pointed me to this great post, with which I couldn't agree more.

After discovering that, by default, friends of friends who comment on Facebook-posted pictures get access to the full album of photos, the author writes:

apophenia: Putting Privacy Settings in the Context of Use (in Facebook and elsewhere)

... Tech developers... I implore you... put privacy information into the context of the content itself. When I post a photo in my album, let me see a list of EVERYONE who can view that photo. When I look at a photo on someone's profile, let me see everyone else who can view that photo before I go to write a comment. You don't get people to understand the scale of visibility by tweetling a few privacy settings every few months and having no idea what "Friends of Friends" actually means. If you have that setting on and you go to post a photo and realize that it will be visible to 5,000 people included 10 ex-lovers, you're going to think twice. Or you're going to change your privacy settings....

Making people think? Good idea.

When privacy has been characterized as minimizing surprises, if you fully let people know what they're doing (particularly when it is somewhat behind the veil of not-well-understood technology) you're doing your job.

Labels: facebook, privacy, social networking

The Globe & Mail is running a series on privacy and social networking sites, particularly Facebook. I'm not sure that readers of this blog will be shocked at what's posted online but it's still an interesting read:

Friday, September 12, 2008: Faceless no more: Social networking comes with a price

Saturday, September 13, 2008: The not-so-private price paid for social networking

On Monday, look for Part 2 of the series in Report on Business: Matt Hartley looks at how social networks have affected consumer privacy and reports on the federal privacy commissioner's plans to safeguard consumer information.

And on Tuesday, we'll run Part 3 — David Hutton reports on the efforts that one Canadian-based social network is making to root out underage users, who, studies show, can be far more revealing than older social networkers.

Labels: facebook, privacy, social networking

ITBusiness has an interesting article on the collaboration between the Ontario Privacy Commissioner and Facebook, including a video interview with the commissioner: Your privacy, your responsibility says Ontario Privacy Commissioner.

Labels: facebook, ontario, privacy, social networking

One of the most interesting phenomena (at least to me) is that privacy is not only being taken away on a number of fronts, the wider front is the mass surrender of privacy by the millions of people who put loads of personal data online.

Some people may think it's ironic that I'm on Facebook or Flickr, but I'm pretty mindful of what I put online and who is my "friend". When I was young and foolish, I posted stuff that's still to be found on the internet. Nothing scaldalous: stuff like a travelogue of a visit to Romania and contributions to listservs about academic freedom. But kids these days, armed with digital cameras, are posting vast quantities of personal information that will hang around for years. And is there for those who may not be their friends.

I happened upon an interesting illustration of this on MetaFilter today (It's not dead, it's just resting MetaFilter). Check out these two videos in which private investigator Steve Ramblan discusses his tradecraft:

Hope2604 – Privacy Is Dead – Get Over It In 2006, privacy expert Steven Rambam’s two hour panel was disrupted by federal authorities who arrested him at the conference just prior to its commencement. In the end, he was completely vindicated and went on to finally give his talk several months later to a packed house at a local university. This year, Steven will be on for three hours, in part to make up for what you may have missed last time, but mostly because what he says about the state of privacy in our society will captivate you. Since 1980, Pallorium's investigators have successfully closed more than 9,500 cases, ranging from homicide investigations to missing persons cases to the investigation of various types of sophisticated financial and insurance frauds. Steven Rambam has coordinated investigations in more than fifty (50) countries, and in nearly every U.S. State and Canadian province. Steven specializes in international and multi-jurisdictional investigations, and within the past few years he has conducted investigations in Israel, South Africa, Holland, France, England, India, Mexico, Guatemala, Spain, Portugal, Bulgaria, Germany, Abu Dhabi, China, Mongolia, the Philippines, Thailand, Laos, Jordan, Vietnam and Brazil, among other locations. For More Information Visit www.pallorium.com

Labels: facebook, privacy, social networking, surveillance

Yesterday's Wall Street Journal had an interesting Op/Ed on privacy, highlighting contemporary expectations of privacy.

Information Age - WSJ.com

Privacy? We Got Over It.

August 25, 2008; Page A11

In 1988, Congress banned video stores from disclosing the titles of films that people rent. The issue arose because in the battle to block Robert Bork from the Supreme Court, someone leaked his video rentals.

Fast-forward to this summer, and a federal judge hearing a $1 billion copyright complaint by Viacom ordered YouTube to turn over online records about which computer addresses were used to watch which videos on the site. The judge dismissed privacy concerns as "speculative." How quickly our expectations of privacy have changed.

Privacy advocates objected that with access to Internet protocol addresses, it would be possible to track who watched what. Hundreds of millions of people have watched videos on YouTube since its founding in 2005 -- indeed, by one estimate, virtually everyone who uses the Web has watched a video on the site. This makes it surprising that there was such little public outcry about this potential loss of privacy. Google, which owns YouTube, has complied with the judge's order by using encryption to hide individual records, but it is indeed "speculative" how much people would object to disclosing this online behavior.

This incident is a telling moment. We seem to be following the advice of Scott McNealy, chairman of Sun Microsystems, who in 1999 said, "You have zero privacy anyway. Get over it." And the observation by Oracle CEO Larry Ellison: "The privacy you're concerned about is largely an illusion. All you have to give up is your illusions, not any of your privacy."

These comments could be dismissed as technology executives trying to minimize complaints about technology. But whatever we say about how much we value privacy, a close look at our actual behavior suggests we have gotten over it. A recent study by AOL of privacy in Britain found that 84% of people said they would not disclose details about their income online, but in fact 89% of them willingly did.

Amazon closely records our taste in books, Gmail scans our emails to deliver relevant ads, and electronic tolls track where we drive. Profiles on MySpace and Facebook are accessible, forever. The disclosure that Judge Bork liked to rent British comedies seems quaint in comparison.

Records about us are no longer kept in scattered manila files in dusty cabinets, but digitally, which means in permanent records that can be combined with other records to paint a full picture of our tastes and habits. Information held by different retailers, insurers and government agencies can be mined to create constantly updated files more complete than the most tenacious intelligence report on a suspected criminal a generation ago.

Privacy advocates do their jobs by reminding us of these risks, but our choices all seem to be in the direction of trading away privacy. The fantastic power and convenience of digital life has led us to change what we consider private in ways that we can only begin to understand.

Indeed, our expectations of privacy have changed radically over time. Stanford law professor Lawrence Friedman in his recent book, "Guarding Life's Dark Secrets," documents the total lack of privacy expectations through the medieval period, when people lived together with no option for privacy, to a period of privacy for some people and some purposes as part of what he calls the "Victorian compromise." Propriety was defined through social norms focused on reputation, which included significant freedom for otherwise scandalous behavior if it was done carefully, in private.

"If the nineteenth century was a world of privacy and prudery, a world of closed doors and drawn blinds," Mr. Friedman writes, "then the world of the twenty-first century is the world of the one-way mirror, the world of the all-seeing eye."

We now seem happy to trust companies with our information for benefits such as one-click buying and online searches for personally relevant results. In a digital world where it is possible to know more than ever about everything, including one another, the new vice may be the flip side of privacy -- concealing information about ourselves of legitimate value to others.

In the physical world, surveillance cameras, satellites and bio-recognition systems have redefined privacy expectations. We have learned that "privacy can be very dangerous," as federal appeals judge Richard Posner has observed. "Obviously if you're a terrorist, privacy is enormously important. So the more we think of privacy as endangering us, that will reinforce these commercial incentives to surrender privacy."

Privacy remains a virtue, or at least we still say it does. But the balance has been tipped by other values, such as transparency, a free flow of information and physical security. We're in the early stages of adapting to more digital and visible lives, with privacy expectations better defined by what we do than by what we say.

Labels: aol, facebook, google, privacy, social networking

A colleague just brought to my attention a case handed down yesterday by the High Court of Justice (Queen's Bench Division) of England & Wales: Applause Store Productions Ltd. & Anor v Raphael [2008] EWHC 1781 (QB) (24 July 2008).

The case relates to the misuse of private information and defamation. The defendant in this case had set up a false Facebook profile in the name of the plaintiff and established a Facebook group that was, shall we say, not flattering of the plaintiff. The court found in favour of the defendant on both claims.

What's additionally interesting is the detail with which the Court reviews the logging data generated by Facebook and provided to the Court. The case is an interesting read for privacy issues, but also is a good chance to look under the hood of Facebook, forensically speaking.

Labels: europe, facebook, litigation, privacy, social networking, uk

The local Halifax paper is running an AP story about the tough choices that custodians of personal information are sometimes called upon to make. After a young girl went missing, the police showed up at the public library demanding to take the public access computers that the girl had apparently used to communicate on MySpace. The librarian stood her ground and demanded that the police get a warrant. They did. Here's the full story:

Nova Scotia News - TheChronicleHerald.ca

Police raid on library offers privacy dilemma

By JOHN CURRAN The Associated Press

Sun. Jul 20 - 5:19 AM

RANDOLPH, Vt. — Children’s librarian Judith Flint was getting ready for the monthly book discussion group for eight and nine-year-olds on Love That Dog when police showed up.

They weren’t kidding around: Five state police detectives wanted to seize Kimball Public Library’s public access computers as they frantically searched for a 12-year-old girl, acting on a tip that she sometimes used the terminals.

Flint demanded a search warrant, touching off a confrontation that pitted the privacy rights of library patrons against the rights of police on official business.

"It’s one of the most difficult situations a library can face," said Deborah Caldwell-Stone, deputy director of intellectual freedom issues for the American Library Association.

Investigators obtained a warrant about eight hours later, but the June 26 standoff in the 105-year-old, red brick library on Main Street frustrated police and had fellow librarians cheering Flint.

"What I observed when I came in were a bunch of very tall men encircling a very small woman," said the library’s director, Amy Grasmick, who held fast to the need for a warrant after coming to the rescue of the 4-foot-10 Flint.

Library records and patron privacy have been hot topics since the passage of the U.S. Patriot Act after the Sept. 11, 2001, terror attacks.

Library advocates have accused the government of using the anti-terrorism law to find out, without proper judicial oversight or after-the-fact reviews, what people research in libraries.

But the investigation of Brooke Bennett’s disappearance wasn’t a Patriot Act case.

"We had to balance out the fact that we had information that we thought was true that Brooke Bennett used those computers to communicate on her MySpace account," said Col. James Baker, director of the Vermont State Police.

"We had to balance that out with protecting the civil liberties of everybody else, and this was not an easy decision to make."

Brooke, from Braintree, vanished the day before the June 26 confrontation in the children’s section of the tiny library.

Investigators went to the library chasing a lead that she had used the computers there to arrange a rendezvous.

Brooke was found dead July 2.

An uncle, convicted sex offender Michael Jacques, has since been charged with kidnapping her.

Authorities say Jacques had gotten into her MySpace account and altered postings to make investigators believe she had run off with someone she met online.

Flint was firm in her confrontation with the police.

"The lead detective said to me that they need to take the public computers and I said ‘OK, show me your warrant and that will be that,’ " said Flint, 56. "He did say he didn’t need any paper.

"I said ‘You do.’ He said ‘I’m just trying to save a 12-year-old girl,’ and I told him ‘Show me the paper.’"

Cybersecurity expert Fred H. Cate, a law professor at Indiana University, said the librarians acted appropriately.

"If you’ve told all your patrons ‘We won’t hand over your records unless we’re ordered to by a court,’ and then you turn them over voluntarily, you’re liable for anything that goes wrong," he said.

Labels: facebook, law enforcement, libraries, privacy, warrants

One of the most problematic features of Facebook, from a privacy point of view, is that Facebook shares data with the owners of Facebook Apps, whose privacy practices are not well articulated or well understood. This week, the Washington Post had an interesting article highlighting this problem. See: A Flashy Facebook Page, at a Cost to Privacy - washingtonpost.com.

Labels: facebook, privacy, social networking

The federal, provincial and territorial privacy commissioners are meeting this week in Regina and have jointly started a new initiative, youthprivacy.ca. Here's the media release describing it:

News Release: Privacy Advocates Express Concern About Child Privacy Online (June 4, 2008) - Privacy Commissioner of Canada

Privacy Advocates Express Concern About Child Privacy Online

Regina, June 4, 2008 — As Canadian youth spend more time online, they run the risk of losing control of their personal information and, potentially, facing complications at home, school or work.

Canada’s privacy commissioners and ombudspersons issued a joint resolution today expressing their commitment to work together to improve the state of online privacy for children and young people.

“It’s time to stop the commercial exploitation of our children. It’s high time we came to terms with the impact of the Internet on youth and their lives,” says Saskatchewan Information and Privacy Commissioner, Gary Dickson.

The resolution was the product of the semi-annual meeting of Canada’s privacy commissioners and ombudsmen from federal, provincial and territorial jurisdictions across Canada, being held June 4 and 5 in Regina, Saskatchewan.

During the meeting, the commissioners and ombudspersons heard from a panel of young people about their online activities and their attitudes towards, and concerns about, privacy online.

"Young people are very adept and comfortable with electronic communication. As advocates, we have to help young Canadians find the information they need to be their own privacy watchdogs," says Irene Hamilton, Manitoba Ombudsman.

Many of Canada’s privacy commissioners and ombudsmen have already proposed tools and learning materials on youth privacy, frequently in cooperation with provincial ministries of education and local school boards.

Beginning today, young people will be able to turn to youthprivacy.ca, an interactive website that offers advice about how youth can protect their personal information and take charge of how their identity is being shaped online.

Youthprivacy.ca also features a blog where young Canadians can discuss how technology is affecting their privacy.

“Young Canadians are among the most wired in the world,” says the Assistant Privacy Commissioner of Canada, Elizabeth Denham. “They need to understand that all these new technologies can have a significant impact on their privacy, and they need to know what they can do to prevent others from accessing and using this information without permission.”

Ms. Denham also announced that the Office of the Privacy Commissioner is launching a contest for youth, ages 12 to 18. The “My Privacy and Me” National Video Competition invites youth to create their own video public service announcements on the issue of privacy. Detailed information about the contest is featured on the new web site.

“The video can be about any aspect of privacy they want to explore—like the ever-growing presence of security cameras, the popularity of social networking sites like MySpace, Facebook, Bebo or Xanga, or how their favourite store collects personal information for marketing purposes,” says Assistant Commissioner Denham. “We want to encourage young people to explore the issues around online privacy and empower them to stand up for their right to privacy.”

In coming months, Canadians can expect to see more tools and learning materials designed to help Canadian youth tackle the challenge of managing their personal information and identity in an increasingly dynamic online world.

— 30 —

For more information and/or media interview requests, contact:

Colin McKay

Office of the Privacy Commissioner of Canada

Tel: (613) 947-7226

Email: cmckay@privcom.gc.ca

Labels: facebook, privacy, social networking

I just gave a presentation in Toronto on privacy and social networking sites. Social networking is very interesting and problematic from a privacy point of view. Unlike other online services, social networking sites are all about the collection, use and ultimate disclosure of personal information. Also, unlike other online services, it is the users (who sign up) who want their information to be disclosed. They want to know what their friends are up to and they want to reciprocate by providing this information to their friends and others. It can be fun and very useful for things like organizing parties, keeeping in touch and (as I've found out by reconnecting with most of my friends from grade 8) reconnecting with people with whom you've lost touch. The key, from a privacy point of view, is making sure that the users are aware of what happens with their information and are given maximum control over how that information is used.

Being on the leading edge of this social networking revolution, Facebook has had its share of privacy blunders. Legions of its users freaked out when the company rolled out the "mini feed" without adequate notice, but now most users find this to be one of the greatest features. Similarly, the Beacon advertising service caused a huge uproar when introduced. Again, this was done without giving people adequate notice and in both cases they were introduced on an opt-out basis without the default being privacy protective.

The main issue, in my view, for social networking sites is to be clear to users about how their information is used and disclosed and to give users maximum control over that use and disclosure. As a Facebook user myself, I think that they've done a good job of providing users with tools to control use and disclosure, but have fallen down on the job of educating their users and by taking an opt-out position on most of the privacy settings.

I will be very interested to see how the Privacy Commissioner deals with the complaint. The Commissioner has already published information about social networking and privacy, so has certainly had an opportunity to consider many of these issues. Stay tuned to hear how it turns out.

Here's the detailed summary of the complaint:

Summary of PIPEDA Complaint

To summarize, we submit that Facebook is in violation of the following PIPEDA provisions in the following regards:

Principle 4.2 – Identifying Purposes:

Principle 4.2.2

Principle 4.2.2 requires that an “organization identify the purpose for which personal information is collected at or before the time of collection” and that an “organization collect only the information necessary for the purposes that have been identified.”

• Facebook allows third party application developers to access User information that is beyond what is necessary to operate their applications.

Principle 4.2.3

Principle 4.2.3 sets out that “the identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected.”

• Facebook does not precisely identify why Users’ information is collected from other sources.

Principle 4.2.4

Principle 4.2.4 sets out that “when personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use. Unless the new purpose is required by law, the consent of the individual is required before information can be used for that purpose.”

• Facebook reserves the right to modify or add to its Terms of Use without notice.
• Facebook retains deceased Users’ profile for memorial reasons, a new purpose.

Principle 4.2.5

Principle 4.2.5 recommends that information collectors “should be able to explain to individuals the purpose for which the information is being collected.”

• Facebook does not explain to Users why third party application developers need access to all their User information.

Principle 4.3 – Consent:

Principle 4.3.1

Principle 4.3.1 sets out that “consent is required for the collection of personal information and the subsequent use or disclosure of this information.”

• Facebook does not obtain the consent of non-Users to collect their information from Users, to share their information with other Users, and to retain their information.

Principle 4.3.2

Principle 4.3.2 sets out that “organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used” and that meaningful consent requires that “the purposes must be stated in such a way that the individual can reasonably understand how the information will be used or disclosed”.

• Facebook does not make a reasonable effort to ensure that Users are advised of:
  • The purposes for which their dates of birth will be used;
  • The purpose of using User information for Social Ads;
  • All the types of information that are shared with third party application developers, including Friends’ information; and
  • The purpose behind retaining information of Users who have deactivated their accounts.

Principle 4.3.3

Principle 4.3.3 sets out that “an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified and legitimate purposes.”

• Facebook requires Users, as a condition of use of its service, to:
  • Provide their dates of birth despite that its purpose for doing so is not explicitly specified; and
  • Participate in one variation of Social Ads despite that this activity is beyond that required to fulfill Facebook’s explicitly specified and legitimate purpose of social networking.
• Facebook requires Users, as a condition to use of third party platforms, to:
  • Share personal information with third party application developers that is beyond what is required to fulfill the purposes of the applications.
  • Facebook retains non-Users’ email addresses for purposes beyond sending them an email to invite them to Facebook.

Principle 4.3.6

Principle 4.3.6 sets out that “an organization should generally seek express consent when the information is likely to be considered sensitive.”

• Facebook does not obtain express consent to share sensitive information in the following ways:
  • Users’ information with other Users in joined Networks;
  • Users’ photo albums and associated comments with everyone;
  • Users’ name and picture searchable to everyone;
  • Users’ information with third party application developers and with third party advertisers;
  • Non-User’s information, including photographs, with Users; and
  • To retain Users’ information after they deactivate their accounts.

Principle 4.3.8

Principle 4.3.8 sets out that “An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.”

• Facebook does not permit active Users to withdraw consent from the Social Ads that are displayed in the left hand “Ad Space” of their Profiles.
• Facebook does not inform Users who withdraw consent to share their personal information with third party application developers that all their applications will be lost.

CIPPIC files privacy complaint against Facebook

The Canadian Internet Policy and Public Interest Clinic (CIPPIC), based at the University of Ottawa, Faculty of Law, has asked the Privacy Commissioner of Canada to investigate alleged violations of Canadian privacy law by the popular social networking site, Facebook. CIPPIC’s 35-page complaint alleges 22 separate violations by Facebook, including its failure to inform Facebook members of how their personal information is disclosed to third parties for advertising and other profit-making activities and its failure to obtain permission from Facebook members to such uses and disclosures of their personal information.

A team of law students, some of whom are dedicated Facebook users, analysed the company’s policies and practices as part of a clinic course this past winter and identified specific practices that appear to violate the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”).

“Social networking online is growing phenomenon,” said Clinic Director Philippa Lawson. “It is proving to be a tremendous tool for community-building and social change, but at the same time, a minefield of privacy invasion. We chose to focus on Facebook because it is the most popular social networking site in Canada and because it appeals to young teens who may not appreciate the risks involved in exposing their personal details online.”

Facebook has more than seven million Canadian members, with more joining every day. This makes Canada the third largest user base, after the U.S.A. and the U.K.

“Facebook purports to provide users with a high level of control over their data,” said Harley Finkelstein, one of the law students who lodged the complaint. “But our investigation found that this is not entirely true – for example, even if you select the strongest privacy settings, your information may be shared more widely if your Facebook Friends have lower privacy settings.

As well, if you add a third party application offered on Facebook, you have no choice but to let the application developer access all your information even if they don’t need it”.

Jordan Plener, another law student who worked on the complaint, noted that “although Facebook has taken steps to allow for more control over sharing one’s information on the site, its default settings are for sharing in most cases. Changing those settings requires a high level of aptitude and experience with the site. We believe that many Facebook Users, especially young people, don’t appreciate the extent to which their often sensitive personal information is being shared beyond their social circle.”

“We're concerned that Facebook is deceiving its users,” said Lisa Feinberg, another law student behind the Complaint. “Facebook promotes itself as a social utility, but it's also involved in commercial activities like targeted advertising. Facebook users need to know that when they're signing up to Facebook, they're signing up to share their information with advertisers.” Under PIPEDA, the Privacy Commissioner has up to a year to investigate and render her findings on the complaint.

Labels: facebook, privacy, social networking

I've never been liveblogged before, but there's a first time for everything. I'm currently in Montreal at http://legalit.ca/en/2008program. I had the honour of being on a panel with the Privacy Commissioner of Canada, Jennifer Stoddart, and Professor Pierre Trudel.

My presentation from this morning was summarized by Patrick Cormier on Slaw.ca. See: Slaw - Social networking and privacy

You can see my PowerPoint slides here: http://docs.google.com/Presentation?id=ddpx56cg_107g8chjhff

Labels: facebook, google, presentations, privacy

Michael Zimmer caught my link to the Times Online article with questions for Facebook's CPO. He points out that the questions are pretty easy. Instead, he proposes some real questions: michaelzimmer.org » Archives » Real Questions for Facebook’s Chief Privacy Officer.

I'd like to see the answers.

Labels: facebook, privacy, social networking

Labels: facebook, privacy, social networking

Rob Hyndman has a great post about Facebook and why he's finding it increasingly boring. The site has loads of users' personal information. It knows who your friends are and who their friends are. It knows what you post and it knows who you are closest with. It knows your social network and what's going on in it.

So, Rob asks, why isn't Facebook using that information to be more useful for the user? Why doesn't it introduce you to friends of friends who you'd probably like? Why doesn't it suggest TV shows? Or let you rate your music and share your recommendations among similarly-minded friends (or foafs). Loads of websites take your personal information and offer a single service in return. But Facebook and social networking sites take loads of personal information, analyze it to death but don't offer the users with a complete return on that personal information. Good questions, Rob. For those who opt in, that would be the Web 2.0 killer app. See: robhyndman.com » Blog Archive » What Facebook Needs to do to Not be Boring.

Labels: facebook, privacy, social networking

Labels: facebook, privacy, social networking

I just got a notice about what should be an interesting online debate, hosted by the Economist.com. From an e-mail from The Economist:

I’m reaching out on behalf of The Economist Debate Series a program of open conversations on important global topics led by high-profile debaters.

Our second series of three debates kicks off today and the first proposition raises important questions about civil rights and the trade-off between Privacy vs. Security. As a blogger and member of the community that The Economist aims to serve with this lively debate, we wanted to extend an invitation to you and the readers of Canadian Privacy Law Blog to join the debate by blogging or commenting to the debate floor. (No subscription is necessary).

More details are below…

Timing & Proposition:

Feb. 5 – Feb 15: “Privacy vs. Security – This house believes that security in the modern age cannot be established without some erosion of individual privacy.”

Should people sacrifice elements of our privacy for the sake of making our world a more secure place?

Expert Debaters & Moderator

Two global thought leaders in security and freedom will square off on either side of the issue.

Pro: Neil C. Livingstone, Chairman and CEO of ExecutiveAction LLC

Livingstone is the chairman and CEO of ExecutiveAction LLC, an international business solutions and risk management company. In addition to serving on numerous homeland security advisory boards, Livingstone has written nine books and more than 200 articles on terrorism and national security and has appeared on more than 1,300 television programmes as a commentator on intelligence and national-security issues.

Con: Bob Barr, Chair for Freedom and Privacy at the American Conservative Union

A former member of the U.S. House of Representatives from Georgia (1995-2003), Barr now occupies the 21st Century Liberties Chair for Freedom and Privacy at the American Conservative Union. In addition to teaching and practicing law, Barr serves as a board member of the National Rifle Association and heads a consulting firm, Liberty Strategies LLC. Dubbed by the New York Times as “Mr. Privacy”, Barr writes and speaks widely on civil liberties. Previously, Mr. Barr served as the U.S. Attorney in Atlanta, and as an official with the CIA.

Moderator: Daniel Franklin, Executive Editor, The Economist & Editor-In-Chief, Economist.com & Editor, The World in 2008

Guest Participants

Additional leaders in this field are serving as guest participants through the course of the debate:

Thomas M. Sanderson Deputy Director and Senior Fellow, Transnational Threats Project (CSIS)

Scott Berinato, Executive Director, CSO Magazine

W. Kenneth Ferree, President, The Progress & Freedom Foundation

Future Debates in the Series

Feb 25 – March 7: Information Management. Is Technology succeeding at simplifying our lives, or is it just making things more complicated? Does the negative impact of information overload outweigh the positive impact of new tools and technologies?

March 18 – 28: IT Governance. Should each country have independent control over its own cyberspace, or should a governing entity oversee the Internet and policies surrounding it?

Also, check out our Facebook group, “I’m Following The Economist Debate Series.”

Please check back regularly to see the latest comments by your industry peers and to see if the moderator or debaters picked up your or other viewpoints from the floor.

Please support discourse, and may intelligence prevail!

Labels: facebook, privacy, social networking

Apparently Facebook has banned Robert Scoble and suspended his account after Facebook determined he was violating the terms of service by using an automated script to "move his social graph" (Facebook disabled my account « Scobleizer — Tech geek blogger). What he was apparently doing was using a script or some other automated tool to "export" information related to his 5000 friends to import the data into Plaxo (What I was using to hit Facebook — unreleased Plaxo Pulse « Scobleizer — Tech geek blogger). Facebook lets you import data from Gmail and other services, but it's a one way street.

His account has been restored, but I hope this spurs some debate over the portability of one's own data, particularly if that includes data about others.

In my view, I think that Facebook is right to prevent this sort of scraping. Facebook is different from your usual address book. There's much more information being shared on social networking sites. Perhaps imprudently, many users add as friends people they really don't know and (un)wittingly expose sensitive information. A facebook profile not only lists that individual in question, but his or her friends.

All of this means that information from a Facebook is more prone to be abused in a manner that the individual may not anticipate. If I add Scoble (or you) as a friend on Facebook, I think I have a good sense of what may happen to that information on Facebook. But I have no clue about what can happen when that information is taken off a trusted platform into some other, unknown, system. It's a bit chilling and Facebook is correct to take the position it has.

There's some additional coverage here: The Scoble scuffle: Facebook, Plaxo at odds over data portability The Social - CNET News.com, but you should also read the comments on Scoble's own posts as they represent an interesting slice of opinion.

Labels: facebook, privacy, social networking

Today marks the fourth anniversary of the Canadian Privacy Law Blog. Four years ago, on January 2, 2004, I put fingers to keyboard and joined the interesting conversation that was beginning to take shape on the internet among veteran bloggers and I'm glad I did. (Welcome to the Canadian Privacy Law blog.) According to Blogger, this will be my 2740th post to the blog.

Forgive me if I get a bit melancholic and wistful as I look back on the past four years, but it has been a very eventful one for me and for the world of privacy. And both are related, I think. (I mean the changes in the world of privacy have influenced me, not the other way around.)

The day before my first posting, the Personal Information Protection and Electronic Documents Act ("PIPEDA") came fully into force for all commercial activities in Canada. That day, the Personal Information Protection Acts of British Columbia and Alberta came into force, but were not declared to be "substantially similar" to PIPEDA until ten months later (Alberta and British Columbia privacy laws declared to be substantially similar.) Also on the legislative front, Ontario passed the Personal Health Information Protection Act and it became law in May, 2004 (Ontario's Personal Health Information Protection Act receives royal assent.) Perhaps as importantly, it was declared substantially similar on November 28, 2005. (PHIPA declared substantially similar.)

Much attention has been paid to the continuing erosion of privacy rights in the United States and Canada. In 2004, the Information and Privacy Commissioner of British Columbia brought the USA Patriot Act under scrutiny. (U.S. Patriot Act worries Privacy Commissioner and BC Information and Privacy Commissioner releases his report: Patriot Act contravenes BC privacy laws.) In response, British Columbia, Alberta and Nova Scotia have passed laws or amendments to existing laws to closely regulate the export of personal information outside of Canada. In the US, the USA Patriot Act has been subject to many judicial challenges with some success.

Perhaps the area that has been most visible to laypeople is the growing trend of requiring companies to report data breaches. California led the way and now more than thirty US states have such requirements. We haven't seen it in Canada (except in PHIPA in Ontario) but advocates are calling for such a requirement in Canada's privacy laws of general application. Coming clean has led to the public disclosure of a number of huge breaches, including Cardsystems, TJX/Winners, Department of Veterans Affairs and the UK Revenue and Customs Service. Whether we see a change in Canadian law has yet to be seen. Despite the huge publicity given to these breaches, business built on personal information -- such as Facebook -- thrive.

On the professional front, I've been very fortunate to have been invited to speak on the topic of privacy on more occasions than I can estimate. Highlights have been speaking at the Canadian Bar Association general meeting in Winnipeg in 2005, Canadian IT Law Association for the past few years and innumerable professional organizations. The blog has also led to innumerable media interviews and some amazing awards (I'd like to thank the academy. And my blog ... and An honour to even be considered.)

Perhaps more satisfying is that I've been fortunate to have met (in some cases, in the flesh) and to have been inspired by some great fellow legal bloggers. This list includes Connie Crosby, Rob Hyndman, David Canton, Michael Geist, Michael Fitzgibbon and the amazing Slawyers.

To my readers, thank you very much for taking the time to drop by. I hope it has been informative and useful. Please pass along any suggestions or your thoughts, either in the comments to my posts or via e-mail at david.fraser@mcinnescooper.com.

Birthday cake graphic used under a creative commons license from K. Pierce.

Labels: alberta, bc, facebook, health information, media-mention, patriot act, pipa, privacy, social networking, vanity

Privacy resolutions from the Privacy Commissioner of Canada:

News Release: Do you resolve to protect your privacy in 2008? (December 27, 2007) - Privacy Commissioner of Canada

Do you resolve to protect your privacy in 2008?

OTTAWA, December 27, 2007 – Threats to the privacy rights of Canadians will intensify in 2008 unless organizations resolve to do more to protect personal information, warns Privacy Commissioner of Canada Jennifer Stoddart.

“Heightened national security concerns, the growing business appetite for personal information and technological advances are all potent – and growing – threats to privacy rights,” says Commissioner Stoddart.

“The coming year will be another challenging one for privacy in Canada.”

With that prediction in mind, Commissioner Stoddart today released her 2008 list of top 10 suggested New Year’s resolutions for businesses, individuals and government.

Resolutions for businesses in Canada:

1. Protect personal information with strong security.

More than 162 million records were compromised by theft or loss in 2007, triple the number of data losses for the previous year, according to a USA Today analysis of breaches in the US, Canada and other countries. This alarming trend can be reversed if businesses begin to recognize the value of personal information. The disastrous breach involving Winner’s and HomeSense stores is an example of what can go wrong if businesses don’t invest in the latest security.

2. Use encryption to protect personal information on mobile devices such as laptops.

We are seeing too many headlines about personal information at risk because a laptop has been lost or stolen. Organizations must ensure personal information on a mobile device is encrypted – protecting information stored on a laptop with a password is simply not enough.

3. Ensure credit card processing equipment masks complete card numbers on receipts.

Complete credit card numbers should not be printed on receipts for electronically processed transactions. Businesses were supposed to switch to electronic processing equipment that masks card numbers – for example, by printing Xes – by the end of 2007. Printing complete card numbers exposes customers to the risk of identity theft. (Some very small businesses may still be manually taking imprints of cards because it is not economically feasible for them to purchase electronic equipment. They should still take all steps necessary to protect the information they collect.)

Resolutions for Canadians:

4. Think twice before posting personal information on social networking sites.

Many Facebook and Myspace users think of these sites as private, when, in reality, the information they post can often be seen by just about anyone. Before posting something, ask questions such as: How would I feel defending this comment or photo during a job interview five years from now? Am I harming someone else or invading someone’s privacy by posting this comment, photo or video? We like this simple rule of thumb: If Grandma shouldn't know, it shouldn't be posted.

5. Ask questions when someone asks for personal information.

It’s a good idea to understand why information such as your phone number or postal code, or driver’s licence is being requested and how it will be used. If you are concerned about receiving junk mail or telemarketing calls, decline to provide the information. Canada’s privacy laws offer you a choice about providing personal information that is not necessary for a transaction.

6. Take steps to protect your personal information.

Invest in a good shredder or burn all documents that include your name, address, SIN, financial information or other sensitive personal information. Papers containing personal information don’t belong in the recycling bin.

Resolutions for the federal government:

7. Overhaul the no-fly list to ensure strong privacy protections for Canadians.

The no-fly list involves the secretive use of personal information in a way that has very serious impact on privacy and other human rights. Innocent Canadians face the very real risk they will be stopped from flying because they’ve been incorrectly listed or share the name of someone on the list.

8. Move forward with proposed reforms to Canada’s privacy laws.

The federal government is currently holding consultations on important amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA). These proposed changes include mandatory breach notification, a step that would encourage businesses to take security more seriously and protect Canadians against identity theft.

We also urge the federal government to open a review of the Privacy Act, which will be celebrating its 25th anniversary in 2008. Canadians should be offered the same level of legal protection under the Privacy Act as they have, as consumers, under PIPEDA.

9. Ensure that identity theft legislation is swiftly passed.

The government has introduced Criminal Code amendments to help police stop identity thieves or fraudsters before Canadians suffer actual financial harm. The changes include explicit penalties for collecting, possessing and trafficking in personal information.

10. Develop anti-spam legislation.

Canada remains the only G-8 country without anti-spam legislation, raising the danger that we will become a harbour for spammers. Halting the proliferation of spam is another important measure necessary to address identity theft.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

Labels: breach notification, facebook, laptop, privacy, privacy act, social networking, telemarketing